b79896c237
hive-c0re copies the hive's store read token to /run/hyperhive/forge-hive-token for nix's git credential helper, and no longer mints, reads or falls back to the core admin token. drops the core user sweep, avatar upload, webhook cleanup and hive-priv's RunForgeAdmin.
45 lines
2 KiB
Nix
45 lines
2 KiB
Nix
# Git settings for the host processes that hand nix a forge URL: hive-c0re
|
|
# (prebuilds as `hive-core`) and hive-priv (builds as root, with a HOME of its
|
|
# own), each through its own `$HOME/.gitconfig`. nix runs `git` for a `git+…`
|
|
# input, so git's config is the only credential and URL plumbing it has.
|
|
#
|
|
# - `credential`: the forge host answers through `git-credential-hive-forge`,
|
|
# which reads the hive's own forge account and token from the file hive-c0re
|
|
# publishes. An empty `helper =` first resets the list, so no /etc/gitconfig
|
|
# helper (e.g. `oauth`, which waits on a browser) runs ahead of ours.
|
|
# - `url`: the swarm's `internal/meta` lock names its inputs by the forge's
|
|
# `https` URL, which only the builder's credential helper answers for. They
|
|
# are fetched over the `http` URL the helper above is scoped to.
|
|
#
|
|
# Pure function — NOT a NixOS module (don't add it to the host-modules
|
|
# aggregator). Call it from a module's `let`:
|
|
#
|
|
# forgeGit = import ./lib/hive-forge-git.nix { inherit pkgs; forgeDomain = …; };
|
|
# # then put `forgeGit.credentialHelper` on the unit's `path` and
|
|
# # `forgeGit.config` into its gitconfig.
|
|
{ pkgs, forgeDomain }:
|
|
{
|
|
# Answers only `get`. The file (`/run/hyperhive/forge-hive-token`, hive-c0re's
|
|
# `paths::FORGE_HIVE_TOKEN`) holds the account on its first line and the
|
|
# token on its second; it is read on every invocation, so it never holds a
|
|
# stale copy and survives token rotation. Prints nothing where the file is
|
|
# absent or incomplete.
|
|
credentialHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
|
|
[ "''${1:-}" = "get" ] || exit 0
|
|
[ -r /run/hyperhive/forge-hive-token ] || exit 0
|
|
{ read -r login; read -r token; } < /run/hyperhive/forge-hive-token || true
|
|
[ -n "$login" ] && [ -n "$token" ] || exit 0
|
|
printf 'username=%s\n' "$login"
|
|
printf 'password=%s\n' "$token"
|
|
'';
|
|
|
|
config = ''
|
|
[credential]
|
|
helper =
|
|
[credential "http://${forgeDomain}"]
|
|
helper =
|
|
helper = hive-forge
|
|
[url "http://${forgeDomain}/"]
|
|
insteadOf = https://${forgeDomain}/
|
|
'';
|
|
}
|